Thanks very much for both of your suggestions. This is a little outside the realm of the searches I am used to so I am having trouble wrapping my head around it a bit.
Here are the two searches that give me the data that I want.
source="WMI:FreeDiskSpace" earliest=-3mon@d latest=-3mon@d+d | stats Max(FreeMegabytes) as FreeMBs by host,Name | eval FreeGBs=FreeMBs/1024 | table host, Name, FreeGBs
source="WMI:FreeDiskSpace" earliest=-d@d latest=@d | stats Max(FreeMegabytes) as FreeMBs by host,Name | eval FreeGBs=FreeMBs/1024 | table host, Name, FreeGBs
So what I am hoping for is to add two panels (getting ahead of myself) to my dashboard, the first which is a table showing host, Name (which is the drive letter), Change.
The second would be a bar chart grouped by server & disk (combined with something like: "eval Drive=host+"-"+Name "?) with the 3 months ago disk space as one bar, the current as a second. (I can tackle this one as a separate item, but just trying to pain the picture of what I am trying to accomplish).
Thanks for your help,
Kevin
... View more